@warmhub/cli 0.79.1 → 0.81.0

package/dist/wh.js

@@ -19146,6 +19146,31 @@ var import_usingCtx = __toESM(require_usingCtx(), 1);
 var import_awaitAsyncGenerator = __toESM(require_awaitAsyncGenerator(), 1);
 var import_wrapAsyncGenerator = __toESM(require_wrapAsyncGenerator(), 1);
 var import_objectSpread29 = __toESM(require_objectSpread2(), 1);
+// ../../packages/rules/src/authority-coverage.ts
+var EMPTY_COVERAGE = Object.freeze({
+  include: Object.freeze([])
+});
+var FULL_REPO_COVERAGE = Object.freeze({
+  include: Object.freeze(["**"])
+});
+var EMPTY_COVERAGE_SET = Object.freeze([]);
+var FULL_REPO_COVERAGE_SET = Object.freeze([
+  Object.freeze([FULL_REPO_COVERAGE])
+]);
+// ../../packages/rules/src/stable-json.ts
+function stableJson(value) {
+  if (!value || typeof value !== "object") {
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map((entry) => stableJson(entry)).join(",")}]`;
+  }
+  const record = value;
+  return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stableJson(record[key])}`).join(",")}}`;
+}
+function stableJsonEquals(left, right) {
+  return stableJson(left) === stableJson(right);
+}
 // ../../packages/rules/src/builtin-shapes.ts
 var BUILTIN_SHAPE_NAMES = [
   "Arc",
@@ -19174,8 +19199,18 @@ var SYNTHESIZED_CONTENT_NAMES = ["LlmsTxt"];
 var isContentShape = (s) => s === "Content";
 var isStoredContentName = (n) => STORED_CONTENT_NAMES.includes(n);
 var isSynthesizedContentName = (n) => SYNTHESIZED_CONTENT_NAMES.includes(n);
+var BUILTIN_VIEW_SHAPE_NAMES = ["View"];
+var isViewShape = (name) => BUILTIN_VIEW_SHAPE_NAMES.includes(name);
+var BUILTIN_LICENSE_SHAPE_NAMES = [
+  "LicenseSubject",
+  "LicenseDeclaration"
+];
+var isLicenseShape = (name) => BUILTIN_LICENSE_SHAPE_NAMES.includes(name);
+function isRenameableSquattedShape(name) {
+  return isReservedCollectionShape(name) || isViewShape(name) || isLicenseShape(name);
+}
 function isBuiltinShape(name) {
-  return BUILTIN_SHAPE_NAMES.includes(name) || BUILTIN_CONTENT_SHAPE_NAMES.includes(name);
+  return BUILTIN_SHAPE_NAMES.includes(name) || BUILTIN_CONTENT_SHAPE_NAMES.includes(name) || BUILTIN_VIEW_SHAPE_NAMES.includes(name) || BUILTIN_LICENSE_SHAPE_NAMES.includes(name);
 }
 var BUILTIN_SHAPE_DEFS = {
   Arc: {
@@ -19228,9 +19263,76 @@ var BUILTIN_CONTENT_SHAPE_DEFS = {
     description: "Built-in content shape (Readme / Agents / LlmsTxt well-known names)"
   }
 };
+var VIEW_QUERY_DIALECT = "warmquery/v1";
+var BUILTIN_VIEW_SHAPE_DEFS = {
+  View: {
+    fields: {
+      dialect: {
+        type: "string",
+        description: `Query dialect stamp (${VIEW_QUERY_DIALECT})`
+      },
+      query: {}
+    },
+    description: "A named, shareable WarmQuery definition bound to durable IDs"
+  }
+};
+var BUILTIN_LICENSE_SHAPE_DEFS = {
+  LicenseSubject: {
+    fields: {
+      scope: {
+        type: "string",
+        description: "What portion of the repository is being licensed"
+      },
+      "note?": {
+        type: "string",
+        description: "Optional clarification of the licensed scope"
+      }
+    },
+    description: "A licensable body of work in this repository"
+  },
+  LicenseDeclaration: {
+    fields: {
+      "licenseWref?": {
+        type: "wref",
+        description: "Canonical license reference when one license applies"
+      },
+      spdxIdRaw: {
+        type: "string",
+        description: "Declared SPDX identifier or raw license value"
+      },
+      "spdxExpression?": {
+        type: "string",
+        description: "Full SPDX expression for compound declarations"
+      },
+      "appliesTo?": {
+        type: "string",
+        description: "Kind of work covered by the declaration"
+      },
+      "attributionText?": {
+        type: "string",
+        description: "Attribution text reusers should preserve"
+      },
+      "declaredBy?": {
+        type: "string",
+        description: "Person or organization making the declaration"
+      },
+      "sourceUrl?": {
+        type: "string",
+        description: "Upstream source for the licensing terms"
+      },
+      "note?": {
+        type: "string",
+        description: "Optional declaration caveats or clarification"
+      }
+    },
+    description: "Declares the license of a LicenseSubject"
+  }
+};
 var ALL_BUILTIN_SHAPE_DEFS = {
   ...BUILTIN_SHAPE_DEFS,
-  ...BUILTIN_CONTENT_SHAPE_DEFS
+  ...BUILTIN_CONTENT_SHAPE_DEFS,
+  ...BUILTIN_VIEW_SHAPE_DEFS,
+  ...BUILTIN_LICENSE_SHAPE_DEFS
 };
 // ../../packages/rules/src/client-header.ts
 var CLIENT_HEADER = "X-WarmHub-Client";
@@ -19297,21 +19399,6 @@ function resolveComponentTemplate(value, ctx) {
   });
 }
 
-// ../../packages/rules/src/stable-json.ts
-function stableJson(value) {
-  if (!value || typeof value !== "object") {
-    return JSON.stringify(value);
-  }
-  if (Array.isArray(value)) {
-    return `[${value.map((entry) => stableJson(entry)).join(",")}]`;
-  }
-  const record = value;
-  return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stableJson(record[key])}`).join(",")}}`;
-}
-function stableJsonEquals(left, right) {
-  return stableJson(left) === stableJson(right);
-}
-
 // ../../packages/rules/src/org-activity-events.ts
 var ORG_MEMBER_ADDED_EVENT_TYPE = "org.member_added";
 var ORG_REPO_CREATED_EVENT_TYPE = "org.repo_created";
@@ -20225,19 +20312,6 @@ function validateManifestSemantics(manifest) {
   }
   return findings;
 }
-// ../../packages/rules/src/external-contract.ts
-var FORBIDDEN_EXTERNAL_FIELDS = new Set([
-  "_id",
-  "_creationTime",
-  "repoId",
-  "orgId",
-  "thingId",
-  "shapeThingId",
-  "aboutThingId",
-  "currentVersionId",
-  "createdInCommitId",
-  "validatedShapeVersionId"
-]);
 // ../../packages/rules/src/field-name-safety.ts
 var ESCAPE_DISPLAY_MAX_CHARS = 120;
 var DANGEROUS_FORMAT_CODEPOINTS = new Set([
@@ -20336,487 +20410,149 @@ function joinFieldIdentityPath(...segments) {
 function joinFieldPathWithEscaper(escapeSegment, segments) {
   return segments.map((segment) => typeof segment === "number" ? `[${segment}]` : escapeSegment(segment)).join(".").replace(/\.\[/g, "[");
 }
-// ../../packages/rules/src/permission-scopes.ts
-var PUBLIC_ORG_PERMISSIONS = new Set([
-  "org:read",
-  "components:read"
+
+// ../../packages/rules/src/shape-types.ts
+var BASE_PRIMITIVE_TYPES = [
+  "number",
+  "string",
+  "boolean",
+  "wref",
+  "array"
+];
+var BASE_PRIMITIVE_TYPE_SET = new Set(BASE_PRIMITIVE_TYPES);
+var VALID_PRIMITIVE_TYPES = new Set([
+  "number",
+  "string",
+  "boolean",
+  "wref",
+  "array",
+  "number?",
+  "string?",
+  "boolean?",
+  "wref?",
+  "array?"
 ]);
-// ../../packages/rules/src/tokens.ts
-var COMMIT_TOKEN_SYNTAX_REMOVED_MESSAGE = "$N/#N commit-token syntax is no longer supported. Use explicit names and explicit wrefs. For assertions about newly created things, create the thing with a deterministic name and set about to that wref in the same commit.";
-var ANY_TOKEN_RE = /[$#]\d+/;
-function hasAnyTokens(s) {
-  return ANY_TOKEN_RE.test(s);
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-
-// ../../packages/rules/src/preflight-commit.ts
-function preflightCommitDiagnostics(operations, options) {
-  const errors = [];
-  rejectCommitTokenSyntax(operations, errors);
-  illegalOpSequences(operations, errors, options?.checkAddAdd ?? true);
-  return errors;
+var STRING_CONSTRAINT_KEYS = new Set([
+  "minLength",
+  "maxLength",
+  "pattern",
+  "enum"
+]);
+var NUMBER_CONSTRAINT_KEYS = new Set(["minimum", "maximum", "integer"]);
+var WREF_CONSTRAINT_KEYS = new Set(["shape"]);
+var ARRAY_CONSTRAINT_KEYS = new Set(["items", "minItems", "maxItems"]);
+var COMMON_TYPESPEC_KEYS = new Set(["type", "description"]);
+var VALID_TYPESPEC_KEYS = new Set([
+  ...COMMON_TYPESPEC_KEYS,
+  ...STRING_CONSTRAINT_KEYS,
+  ...NUMBER_CONSTRAINT_KEYS,
+  ...WREF_CONSTRAINT_KEYS,
+  ...ARRAY_CONSTRAINT_KEYS
+]);
+var CONSTRAINT_KEYS_BY_TYPE = {
+  string: STRING_CONSTRAINT_KEYS,
+  number: NUMBER_CONSTRAINT_KEYS,
+  wref: WREF_CONSTRAINT_KEYS,
+  array: ARRAY_CONSTRAINT_KEYS,
+  boolean: new Set
+};
+function isTypeSpecObject(value) {
+  if (!isPlainObject(value) || !("type" in value))
+    return false;
+  if (typeof value.type !== "string" || !VALID_PRIMITIVE_TYPES.has(value.type))
+    return false;
+  const baseType = value.type.endsWith("?") ? value.type.slice(0, -1) : value.type;
+  const allowedConstraints = CONSTRAINT_KEYS_BY_TYPE[baseType] ?? new Set;
+  if (!Object.keys(value).every((k) => COMMON_TYPESPEC_KEYS.has(k) || allowedConstraints.has(k)))
+    return false;
+  if ("minLength" in value && typeof value.minLength !== "number")
+    return false;
+  if ("maxLength" in value && typeof value.maxLength !== "number")
+    return false;
+  if ("pattern" in value && typeof value.pattern !== "string")
+    return false;
+  if ("pattern" in value && typeof value.pattern === "string" && VALID_PRIMITIVE_TYPES.has(value.pattern)) {
+    const baseType2 = typeof value.type === "string" && value.type.endsWith("?") ? value.type.slice(0, -1) : value.type;
+    if (baseType2 !== "string")
+      return false;
+  }
+  if ("enum" in value && !Array.isArray(value.enum))
+    return false;
+  if ("minimum" in value && typeof value.minimum !== "number")
+    return false;
+  if ("maximum" in value && typeof value.maximum !== "number")
+    return false;
+  if ("integer" in value && typeof value.integer !== "boolean")
+    return false;
+  if ("shape" in value && typeof value.shape !== "string")
+    return false;
+  if ("shape" in value && typeof value.shape === "string" && VALID_PRIMITIVE_TYPES.has(value.shape)) {
+    const baseType2 = typeof value.type === "string" && value.type.endsWith("?") ? value.type.slice(0, -1) : value.type;
+    if (baseType2 !== "wref")
+      return false;
+  }
+  if ("items" in value && typeof value.items === "number")
+    return false;
+  if ("items" in value && typeof value.items === "boolean")
+    return false;
+  if ("minItems" in value && typeof value.minItems !== "number")
+    return false;
+  if ("maxItems" in value && typeof value.maxItems !== "number")
+    return false;
+  return true;
 }
-function getOpName(op) {
-  return op.name;
+function primitiveTypeSpecFromFieldSpec(fieldType) {
+  if (typeof fieldType === "string" && VALID_PRIMITIVE_TYPES.has(fieldType)) {
+    return fieldType;
+  }
+  if (isTypeSpecObject(fieldType)) {
+    return fieldType.type;
+  }
+  return null;
 }
-function tokenStringFields(op) {
-  const fields = [getOpName(op), op.newName];
-  if (typeof op.about === "string") {
-    fields.push(op.about);
+function basePrimitiveTypeFromSpec(fieldType) {
+  const typeSpec = primitiveTypeSpecFromFieldSpec(fieldType);
+  if (!typeSpec)
+    return null;
+  const base = typeSpec.endsWith("?") ? typeSpec.slice(0, -1) : typeSpec;
+  return BASE_PRIMITIVE_TYPE_SET.has(base) ? base : null;
+}
+function fieldDescriptionFromSpec(fieldType) {
+  let unwrapped = fieldType;
+  if (Array.isArray(fieldType) && fieldType.length === 1) {
+    unwrapped = fieldType[0];
   }
-  if (op.members) {
-    fields.push(...op.members);
+  if (isTypeSpecObject(unwrapped)) {
+    if (typeof unwrapped.description === "string")
+      return unwrapped.description;
+    if ((unwrapped.type === "array" || unwrapped.type === "array?") && "items" in unwrapped) {
+      return fieldDescriptionFromSpec(unwrapped.items);
+    }
+    return;
   }
-  return fields;
+  return;
 }
-function rejectCommitTokenSyntax(operations, errors) {
-  for (let i = 0;i < operations.length; i++) {
-    const op = operations[i];
-    if (!op)
-      continue;
-    for (const field of tokenStringFields(op)) {
-      if (field && hasAnyTokens(field)) {
-        errors.push({
-          code: "COMMIT_TOKEN_SYNTAX_REMOVED",
-          operationIndex: i,
-          message: COMMIT_TOKEN_SYNTAX_REMOVED_MESSAGE
-        });
-        break;
-      }
+function displayFieldType(fieldType) {
+  if (typeof fieldType === "string")
+    return fieldType;
+  if (Array.isArray(fieldType)) {
+    if (fieldType.length === 1) {
+      return `${displayFieldType(fieldType[0])}[]`;
+    }
+    return JSON.stringify(fieldType) ?? "unknown";
+  }
+  if (isPlainObject(fieldType)) {
+    if (isTypeSpecObject(fieldType)) {
+      return formatTypeSpecDisplay(fieldType);
+    }
+    if ("type" in fieldType) {
+      return JSON.stringify(fieldType);
     }
   }
-}
-function illegalOpSequences(operations, errors, checkAddAdd) {
-  const opHistory = new Map;
-  for (let i = 0;i < operations.length; i++) {
-    const op = operations[i];
-    if (!op)
-      continue;
-    const name = getOpName(op);
-    if (!name)
-      continue;
-    if (hasAnyTokens(name))
-      continue;
-    const kind = inferOperationKind({ ...op, name });
-    const qualName = kind === "shape" ? `shape:${name}` : `thing:${name}`;
-    const history = opHistory.get(qualName) ?? [];
-    history.push({ operation: op.operation, index: i });
-    opHistory.set(qualName, history);
-  }
-  for (const [qualName, history] of opHistory) {
-    if (history.length < 2)
-      continue;
-    for (let i = 1;i < history.length; i++) {
-      const prev = history[i - 1];
-      const curr = history[i];
-      if (!prev || !curr)
-        continue;
-      const pair = `${prev.operation}+${curr.operation}`;
-      if (checkAddAdd && pair === "add+add") {
-        errors.push({
-          code: "ILLEGAL_OP_SEQUENCE",
-          operationIndex: curr.index,
-          message: `Cannot add "${qualName}" twice in the same commit`
-        });
-      }
-      if (pair === "revise+add") {
-        errors.push({
-          code: "ILLEGAL_OP_SEQUENCE",
-          operationIndex: curr.index,
-          message: `Cannot revise then add "${qualName}" in the same commit`
-        });
-      }
-    }
-  }
-}
-
-// ../../packages/rules/src/preflight-operation.ts
-var collectionTypes = ["arc", "bond", "set", "list", "pair"];
-var canonicalCollectionTypes = ["arc", "bond", "set", "list"];
-var collectionOps = ["add", "revise"];
-var COLLECTION_CREATE_REQUIRES_NAME_MESSAGE = "Collection create requires a name. Collections are ordinary named things (ADR 0004).";
-var COLLECTION_ABOUT_REMOVED_MESSAGE = 'about accepts a wref. Create the collection as its own named operation, then point the assertion at it. Prefer deterministic relationship names, for example: [{"operation":"add","kind":"collection","type":"arc","name":"a-to-b","members":["A","B"]},{"operation":"add","kind":"assertion","about":"Arc/a-to-b","name":"Assertion/example","data":{}}]. For CLI usage, use wh commit submit --file with the two operations.';
-function preflightOpDiagnostics(op, operationIndex) {
-  const errors = [];
-  errors.push(...builtinShapeGuard(op, operationIndex));
-  errors.push(...contentNameGuard(op, operationIndex));
-  errors.push(...plusSignGuard(op, operationIndex));
-  errors.push(...validateCollectionAbouts(op, operationIndex));
-  errors.push(...validateCollectionOps(op, operationIndex));
-  return errors;
-}
-function builtinShapeGuard(op, operationIndex) {
-  const errors = [];
-  const name = op.name;
-  const isShapeRename = op.operation === "rename" && (op.kind === "shape" || op.name !== undefined && !splitLocalPath(op.name));
-  const reservedSourcePassThrough = isShapeRename && name !== undefined && isReservedCollectionShape(name) && op.newName !== undefined && !isReservedCollectionShape(op.newName) && !isBuiltinShape(op.newName);
-  if (name && isRetiredCollectionShape(name) && !reservedSourcePassThrough) {
-    errors.push({
-      code: "RESERVED_NAME",
-      operationIndex,
-      message: `Shape "${name}" is a retired collection shape and cannot be written manually`
-    });
-  }
-  if (op.operation === "rename" && (op.kind === "shape" || op.name !== undefined && !splitLocalPath(op.name)) && op.newName && isRetiredCollectionShape(op.newName)) {
-    errors.push({
-      code: "RESERVED_NAME",
-      operationIndex,
-      message: `Shape "${op.newName}" is a retired collection shape and cannot be written manually`
-    });
-  } else {
-    const builtinShapeName = name && isBuiltinShape(name) && !reservedSourcePassThrough ? name : isShapeRename && op.newName && isBuiltinShape(op.newName) ? op.newName : undefined;
-    if (builtinShapeName && (isShapeRename || op.operation !== "retract" && op.kind === "shape")) {
-      const action = op.operation === "add" ? "created" : op.operation === "rename" ? "renamed" : "revised";
-      errors.push({
-        code: "RESERVED_NAME",
-        operationIndex,
-        message: `Shape "${builtinShapeName}" is a built-in shape and cannot be ${action} manually`
-      });
-    }
-  }
-  if (name) {
-    const local = splitLocalPath(name);
-    if (local && isRetiredCollectionShape(local.shapePrefix)) {
-      errors.push({
-        code: "VALIDATION_ERROR",
-        operationIndex,
-        message: `Cannot ${op.operation} under retired collection shape "${local.shapePrefix}". Triple is read-only and retired for new collection writes.`
-      });
-    } else if (op.kind === "thing" && local && isBuiltinCollectionShape(local.shapePrefix)) {
-      const message = op.operation === "add" ? `Cannot add kind="thing" under built-in shape "${local.shapePrefix}". Use kind="collection" instead.` : `Cannot revise kind="thing" under built-in shape "${local.shapePrefix}". Use kind="collection" to revise a collection.`;
-      errors.push({
-        code: "VALIDATION_ERROR",
-        operationIndex,
-        message
-      });
-    }
-  }
-  return errors;
-}
-function contentNameGuard(op, operationIndex) {
-  if (op.kind !== "thing" || !op.name)
-    return [];
-  const local = splitLocalPath(op.name);
-  if (!local || !isContentShape(local.shapePrefix))
-    return [];
-  const bareName = local.bareName;
-  if (isSynthesizedContentName(bareName)) {
-    return [
-      {
-        code: "READ_ONLY_BUILTIN_CONTENT",
-        operationIndex,
-        message: `${local.shapePrefix}/${bareName} is synthesized; writes are not allowed`
-      }
-    ];
-  }
-  if (!isStoredContentName(bareName)) {
-    return [
-      {
-        code: "UNKNOWN_CONTENT_NAME",
-        operationIndex,
-        message: `${local.shapePrefix}/${bareName} is not a recognized well-known content name`
-      }
-    ];
-  }
-  return [];
-}
-function plusSignGuard(op, operationIndex) {
-  const errors = [];
-  const name = op.name;
-  if (op.newName?.includes("+")) {
-    errors.push({
-      code: "VALIDATION_ERROR",
-      operationIndex,
-      message: `Name "${op.newName}" contains reserved character "+". The "+" character is reserved for the historical collection auto-name namespace and is not allowed in user-supplied names.`
-    });
-    return errors;
-  }
-  if (name?.includes("+")) {
-    if (op.kind === "collection" && op.operation === "add") {
-      errors.push({
-        code: "VALIDATION_ERROR",
-        operationIndex,
-        message: `Name "${name}" contains reserved character "+". The "+" character is reserved for the historical collection auto-name namespace and is not allowed in user-supplied names.`
-      });
-      return errors;
-    }
-    if (op.kind === "collection")
-      return errors;
-    const local = splitLocalPath(name);
-    if (local && isReservedCollectionShape(local.shapePrefix))
-      return errors;
-    errors.push({
-      code: "VALIDATION_ERROR",
-      operationIndex,
-      message: `Name "${name}" contains reserved character "+". The "+" character is reserved for the historical collection auto-name namespace and is not allowed in user-supplied names.`
-    });
-  }
-  return errors;
-}
-function validateCollectionAbouts(op, operationIndex) {
-  const errors = [];
-  if (!op.about || typeof op.about === "string")
-    return errors;
-  errors.push({
-    code: "VALIDATION_ERROR",
-    operationIndex,
-    message: COLLECTION_ABOUT_REMOVED_MESSAGE
-  });
-  return errors;
-}
-function validateCollectionOps(op, operationIndex) {
-  const errors = [];
-  if (op.kind !== "collection")
-    return errors;
-  if (!collectionOps.includes(op.operation)) {
-    return errors;
-  }
-  if (op.operation === "add" && !op.name) {
-    errors.push({
-      code: "VALIDATION_ERROR",
-      operationIndex,
-      message: COLLECTION_CREATE_REQUIRES_NAME_MESSAGE
-    });
-  }
-  if (!op.type || !collectionTypes.includes(op.type)) {
-    errors.push({
-      code: "VALIDATION_ERROR",
-      operationIndex,
-      message: `Collection "type" is invalid. Use one of: ${canonicalCollectionTypes.join(", ")}. Got: "${op.type ?? ""}"`
-    });
-  }
-  if (!op.members || !Array.isArray(op.members)) {
-    errors.push({
-      code: "VALIDATION_ERROR",
-      operationIndex,
-      message: 'Collection requires a "members" array'
-    });
-  } else {
-    for (let i = 0;i < op.members.length; i++) {
-      if (typeof op.members[i] !== "string") {
-        errors.push({
-          code: "VALIDATION_ERROR",
-          operationIndex,
-          message: `Collection member at index ${i} must be a string`
-        });
-      }
-    }
-  }
-  if (op.type && op.members) {
-    const arityError = collectionArityError(op.type, op.members);
-    if (arityError) {
-      errors.push({
-        code: "VALIDATION_ERROR",
-        operationIndex,
-        message: arityError
-      });
-    }
-  }
-  return errors;
-}
-function collectionArityError(tag, members) {
-  switch (tag) {
-    case "arc":
-      return members.length !== 2 ? `Arc requires exactly 2 members, got ${members.length}` : null;
-    case "bond":
-      return members.length !== 2 ? `Bond requires exactly 2 members, got ${members.length}` : null;
-    case "pair":
-      return members.length !== 2 ? `Pair requires exactly 2 members, got ${members.length}` : null;
-    case "set":
-    case "list":
-      return members.length < 1 ? `${tag === "set" ? "Set" : "List"} requires at least 1 member, got 0` : null;
-  }
-}
-// ../../packages/rules/src/preflight.ts
-function preflightOpDiagnostics2(op, operationIndex) {
-  return preflightOpDiagnostics(op, operationIndex);
-}
-function preflightCommitDiagnostics2(operations, options) {
-  return preflightCommitDiagnostics(operations, options);
-}
-// ../../packages/rules/src/read-limits.ts
-var MAX_GET_MANY_WREFS = 500;
-// ../../packages/rules/src/reserved-orgs.ts
-var RESERVED_RAW_CONTENT_TOP_LEVEL_NAMES = [
-  "_app",
-  "_static",
-  "api",
-  "health",
-  "healthz",
-  "mcp",
-  "readyz",
-  "robots.txt",
-  "sse",
-  "trpc",
-  "version"
-];
-var RESERVED_ORG_NAMES = [
-  ...RESERVED_RAW_CONTENT_TOP_LEVEL_NAMES,
-  "admin",
-  "billing",
-  "blog",
-  "docs",
-  "help",
-  "login",
-  "public",
-  "settings",
-  "signup",
-  "status",
-  "support",
-  "system",
-  "warmhub",
-  "www"
-];
-var RESERVED_ORG_NAME_SET = new Set(RESERVED_ORG_NAMES);
-// ../../packages/rules/src/shape-field-key.ts
-function foldFieldName(name) {
-  const stripped = name.endsWith("?") ? name.slice(0, -1) : name;
-  return stripped.toLowerCase();
-}
-function foldFieldPath(path) {
-  return path.split(".").map((segment) => foldFieldName(segment)).join(".");
-}
-// ../../packages/rules/src/shape-types.ts
-var BASE_PRIMITIVE_TYPES = [
-  "number",
-  "string",
-  "boolean",
-  "wref",
-  "array"
-];
-var BASE_PRIMITIVE_TYPE_SET = new Set(BASE_PRIMITIVE_TYPES);
-var VALID_PRIMITIVE_TYPES = new Set([
-  "number",
-  "string",
-  "boolean",
-  "wref",
-  "array",
-  "number?",
-  "string?",
-  "boolean?",
-  "wref?",
-  "array?"
-]);
-function isPlainObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-var STRING_CONSTRAINT_KEYS = new Set([
-  "minLength",
-  "maxLength",
-  "pattern",
-  "enum"
-]);
-var NUMBER_CONSTRAINT_KEYS = new Set(["minimum", "maximum", "integer"]);
-var WREF_CONSTRAINT_KEYS = new Set(["shape"]);
-var ARRAY_CONSTRAINT_KEYS = new Set(["items", "minItems", "maxItems"]);
-var COMMON_TYPESPEC_KEYS = new Set(["type", "description"]);
-var VALID_TYPESPEC_KEYS = new Set([
-  ...COMMON_TYPESPEC_KEYS,
-  ...STRING_CONSTRAINT_KEYS,
-  ...NUMBER_CONSTRAINT_KEYS,
-  ...WREF_CONSTRAINT_KEYS,
-  ...ARRAY_CONSTRAINT_KEYS
-]);
-var CONSTRAINT_KEYS_BY_TYPE = {
-  string: STRING_CONSTRAINT_KEYS,
-  number: NUMBER_CONSTRAINT_KEYS,
-  wref: WREF_CONSTRAINT_KEYS,
-  array: ARRAY_CONSTRAINT_KEYS,
-  boolean: new Set
-};
-function isTypeSpecObject(value) {
-  if (!isPlainObject(value) || !("type" in value))
-    return false;
-  if (typeof value.type !== "string" || !VALID_PRIMITIVE_TYPES.has(value.type))
-    return false;
-  const baseType = value.type.endsWith("?") ? value.type.slice(0, -1) : value.type;
-  const allowedConstraints = CONSTRAINT_KEYS_BY_TYPE[baseType] ?? new Set;
-  if (!Object.keys(value).every((k) => COMMON_TYPESPEC_KEYS.has(k) || allowedConstraints.has(k)))
-    return false;
-  if ("minLength" in value && typeof value.minLength !== "number")
-    return false;
-  if ("maxLength" in value && typeof value.maxLength !== "number")
-    return false;
-  if ("pattern" in value && typeof value.pattern !== "string")
-    return false;
-  if ("pattern" in value && typeof value.pattern === "string" && VALID_PRIMITIVE_TYPES.has(value.pattern)) {
-    const baseType2 = typeof value.type === "string" && value.type.endsWith("?") ? value.type.slice(0, -1) : value.type;
-    if (baseType2 !== "string")
-      return false;
-  }
-  if ("enum" in value && !Array.isArray(value.enum))
-    return false;
-  if ("minimum" in value && typeof value.minimum !== "number")
-    return false;
-  if ("maximum" in value && typeof value.maximum !== "number")
-    return false;
-  if ("integer" in value && typeof value.integer !== "boolean")
-    return false;
-  if ("shape" in value && typeof value.shape !== "string")
-    return false;
-  if ("shape" in value && typeof value.shape === "string" && VALID_PRIMITIVE_TYPES.has(value.shape)) {
-    const baseType2 = typeof value.type === "string" && value.type.endsWith("?") ? value.type.slice(0, -1) : value.type;
-    if (baseType2 !== "wref")
-      return false;
-  }
-  if ("items" in value && typeof value.items === "number")
-    return false;
-  if ("items" in value && typeof value.items === "boolean")
-    return false;
-  if ("minItems" in value && typeof value.minItems !== "number")
-    return false;
-  if ("maxItems" in value && typeof value.maxItems !== "number")
-    return false;
-  return true;
-}
-function primitiveTypeSpecFromFieldSpec(fieldType) {
-  if (typeof fieldType === "string" && VALID_PRIMITIVE_TYPES.has(fieldType)) {
-    return fieldType;
-  }
-  if (isTypeSpecObject(fieldType)) {
-    return fieldType.type;
-  }
-  return null;
-}
-function basePrimitiveTypeFromSpec(fieldType) {
-  const typeSpec = primitiveTypeSpecFromFieldSpec(fieldType);
-  if (!typeSpec)
-    return null;
-  const base = typeSpec.endsWith("?") ? typeSpec.slice(0, -1) : typeSpec;
-  return BASE_PRIMITIVE_TYPE_SET.has(base) ? base : null;
-}
-function fieldDescriptionFromSpec(fieldType) {
-  let unwrapped = fieldType;
-  if (Array.isArray(fieldType) && fieldType.length === 1) {
-    unwrapped = fieldType[0];
-  }
-  if (isTypeSpecObject(unwrapped)) {
-    if (typeof unwrapped.description === "string")
-      return unwrapped.description;
-    if ((unwrapped.type === "array" || unwrapped.type === "array?") && "items" in unwrapped) {
-      return fieldDescriptionFromSpec(unwrapped.items);
-    }
-    return;
-  }
-  return;
-}
-function displayFieldType(fieldType) {
-  if (typeof fieldType === "string")
-    return fieldType;
-  if (Array.isArray(fieldType)) {
-    if (fieldType.length === 1) {
-      return `${displayFieldType(fieldType[0])}[]`;
-    }
-    return JSON.stringify(fieldType) ?? "unknown";
-  }
-  if (isPlainObject(fieldType)) {
-    if (isTypeSpecObject(fieldType)) {
-      return formatTypeSpecDisplay(fieldType);
-    }
-    if ("type" in fieldType) {
-      return JSON.stringify(fieldType);
-    }
-  }
-  return JSON.stringify(fieldType) ?? "unknown";
+  return JSON.stringify(fieldType) ?? "unknown";
 }
 function formatTypeSpecDisplay(spec) {
   const baseType = spec.type;
@@ -20872,6 +20608,7 @@ function displayFieldEntry(fieldType) {
     return { type, description };
   return type;
 }
+
 // ../../node_modules/.bun/re2js@2.8.3/node_modules/re2js/build/index.js
 /*!
 * re2js
@@ -27195,177 +26932,536 @@ var RE2JS = class RE2JS2 {
       input = MatcherInput.utf8(input);
     return new Matcher(this, input);
   }
-  test(input) {
-    if (Utils.isByteArray(input))
-      return this.re2Input.matchUTF8(input);
-    return this.re2Input.match(input);
+  test(input) {
+    if (Utils.isByteArray(input))
+      return this.re2Input.matchUTF8(input);
+    return this.re2Input.match(input);
+  }
+  testExact(input) {
+    const machineInput = Utils.isByteArray(input) ? MachineInput.fromUTF8(input) : MachineInput.fromUTF16(input);
+    return this.re2Input.executeEngine(machineInput, 0, RE2Flags.ANCHOR_BOTH, 0) !== null;
+  }
+  split(input, limit = 0) {
+    const m = this.matcher(input);
+    const result = [];
+    let emptiesSkipped = 0;
+    let last = 0;
+    while (m.find()) {
+      if (last === 0 && m.end() === 0) {
+        last = m.end();
+        continue;
+      }
+      if (limit > 0 && result.length === limit - 1)
+        break;
+      if (last === m.start()) {
+        if (limit === 0) {
+          emptiesSkipped += 1;
+          last = m.end();
+          continue;
+        }
+      } else
+        while (emptiesSkipped > 0) {
+          result.push("");
+          emptiesSkipped -= 1;
+        }
+      result.push(m.substring(last, m.start()));
+      last = m.end();
+    }
+    if (limit === 0 && last !== m.inputLength()) {
+      while (emptiesSkipped > 0) {
+        result.push("");
+        emptiesSkipped -= 1;
+      }
+      result.push(m.substring(last, m.inputLength()));
+    }
+    if (limit !== 0 || result.length === 0)
+      result.push(m.substring(last, m.inputLength()));
+    return result;
+  }
+  *matchAll(input) {
+    const m = this.matcher(input);
+    while (m.find()) {
+      const result = [m.group(0)];
+      for (let i = 1;i <= m.groupCount(); i++) {
+        const groupVal = m.group(i);
+        result.push(groupVal === null ? undefined : groupVal);
+      }
+      result.index = m.start(0);
+      result.input = input;
+      const namedGroups = this.namedGroups();
+      if (Object.keys(namedGroups).length > 0) {
+        const parsedGroups = m.getNamedGroups();
+        for (const key in parsedGroups)
+          if (parsedGroups[key] === null)
+            parsedGroups[key] = undefined;
+        result.groups = parsedGroups;
+      } else
+        result.groups = undefined;
+      yield result;
+    }
+  }
+  toString() {
+    return this.patternInput;
+  }
+  programSize() {
+    return this.re2Input.numberOfInstructions();
+  }
+  groupCount() {
+    return this.re2Input.numberOfCapturingGroups();
+  }
+  namedGroups() {
+    return this.re2Input.namedGroups;
+  }
+  equals(other) {
+    if (this === other)
+      return true;
+    if (other === null || this.constructor !== other.constructor)
+      return false;
+    return this.flagsInput === other.flagsInput && this.patternInput === other.patternInput;
+  }
+};
+
+// ../../packages/rules/src/shape-validation-types.ts
+var MAX_CONTENT_FIELD_BYTES = 64 * 1024;
+var MAX_INDEXABLE_SCALAR_FIELDS_PER_SHAPE = 256;
+var MAX_INDEXABLE_FIELD_PATH_BYTES = 256;
+var UNSUPPORTED_REGEX_SYNTAX_REASON = "uses unsupported regex syntax";
+var CONTENT_FIELD_LIMIT_ERROR = `WarmHub content fields are limited to ${MAX_CONTENT_FIELD_BYTES} bytes. ` + "WarmHub is not a document store; store large documents in S3, Box, Drive, or another document system and reference them from WarmHub instead.";
+var textEncoder = new TextEncoder;
+function utf8ByteLength(value) {
+  return textEncoder.encode(value).byteLength;
+}
+function contentFieldLimitError(path, value) {
+  if (value.length * 3 <= MAX_CONTENT_FIELD_BYTES)
+    return null;
+  const byteLength = utf8ByteLength(value);
+  if (byteLength <= MAX_CONTENT_FIELD_BYTES)
+    return null;
+  return `Field "${path}" is ${byteLength} bytes; ${CONTENT_FIELD_LIMIT_ERROR}`;
+}
+function assertContentFieldWithinLimit(path, value, errors) {
+  const message = contentFieldLimitError(path, value);
+  if (message)
+    errors.push(message);
+}
+function nativeRegexSyntaxError(pattern) {
+  try {
+    new RegExp(pattern);
+    return false;
+  } catch {
+    return true;
+  }
+}
+function normalizePatternForPortableEngine(pattern) {
+  let normalized = "";
+  let inCharacterClass = false;
+  for (let i = 0;i < pattern.length; i++) {
+    const char = pattern[i];
+    if (char === "\\") {
+      const next = pattern[i + 1];
+      if (inCharacterClass && next === "b") {
+        normalized += "\\x08";
+        i++;
+        continue;
+      }
+      normalized += char;
+      if (next !== undefined) {
+        normalized += next;
+        i++;
+      }
+      continue;
+    }
+    if (char === "[") {
+      inCharacterClass = true;
+    } else if (char === "]") {
+      inCharacterClass = false;
+    }
+    normalized += char;
+  }
+  return normalized;
+}
+function compilePortablePattern(pattern) {
+  try {
+    return RE2JS.compile(normalizePatternForPortableEngine(pattern));
+  } catch {
+    return;
+  }
+}
+function unsupportedPortablePatternReason(pattern) {
+  return compilePortablePattern(pattern) ? undefined : UNSUPPORTED_REGEX_SYNTAX_REASON;
+}
+function normalizeOptionalTypeSpec(spec) {
+  if (typeof spec === "string" && spec.endsWith("?")) {
+    return { spec: spec.slice(0, -1), optionalByType: true };
+  }
+  if (isTypeSpecObject(spec) && typeof spec.type === "string" && spec.type.endsWith("?")) {
+    return {
+      spec: { ...spec, type: spec.type.slice(0, -1) },
+      optionalByType: true
+    };
+  }
+  return { spec, optionalByType: false };
+}
+// ../../packages/rules/src/external-contract.ts
+var FORBIDDEN_EXTERNAL_FIELDS = new Set([
+  "_id",
+  "_creationTime",
+  "repoId",
+  "orgId",
+  "thingId",
+  "shapeThingId",
+  "aboutThingId",
+  "currentVersionId",
+  "createdInCommitId",
+  "validatedShapeVersionId"
+]);
+// ../../packages/rules/src/name-charset.ts
+var RESERVED_NAME_SEGMENT_CHARS = ["?", "#", "@", ":", "$"];
+function escapeForCharClass(char) {
+  return char.replace(/[\\\]^-]/g, "\\$&");
+}
+var RESERVED_CLASS_BODY = RESERVED_NAME_SEGMENT_CHARS.map(escapeForCharClass).join("");
+var NAME_SEGMENT_FORBIDDEN_RE = new RegExp(`[${RESERVED_CLASS_BODY}\\s]`);
+var PATH_SEGMENT_FORBIDDEN_RE = new RegExp(`[/${RESERVED_CLASS_BODY}\\s]`);
+// ../../packages/rules/src/permission-scopes.ts
+var PUBLIC_ORG_PERMISSIONS = new Set([
+  "org:read",
+  "components:read"
+]);
+// ../../packages/rules/src/tokens.ts
+var COMMIT_TOKEN_SYNTAX_REMOVED_MESSAGE = "$N/#N commit-token syntax is no longer supported. Use explicit names and explicit wrefs. For assertions about newly created things, create the thing with a deterministic name and set about to that wref in the same commit.";
+var ANY_TOKEN_RE = /[$#]\d+/;
+function hasAnyTokens(s) {
+  return ANY_TOKEN_RE.test(s);
+}
+
+// ../../packages/rules/src/preflight-commit.ts
+function preflightCommitDiagnostics(operations, options) {
+  const errors = [];
+  rejectCommitTokenSyntax(operations, errors);
+  illegalOpSequences(operations, errors, options?.checkAddAdd ?? true);
+  return errors;
+}
+function getOpName(op) {
+  return op.name;
+}
+function tokenStringFields(op) {
+  const fields = [getOpName(op), op.newName];
+  if (typeof op.about === "string") {
+    fields.push(op.about);
   }
-  testExact(input) {
-    const machineInput = Utils.isByteArray(input) ? MachineInput.fromUTF8(input) : MachineInput.fromUTF16(input);
-    return this.re2Input.executeEngine(machineInput, 0, RE2Flags.ANCHOR_BOTH, 0) !== null;
+  if (op.members) {
+    fields.push(...op.members);
   }
-  split(input, limit = 0) {
-    const m = this.matcher(input);
-    const result = [];
-    let emptiesSkipped = 0;
-    let last = 0;
-    while (m.find()) {
-      if (last === 0 && m.end() === 0) {
-        last = m.end();
-        continue;
-      }
-      if (limit > 0 && result.length === limit - 1)
+  return fields;
+}
+function rejectCommitTokenSyntax(operations, errors) {
+  for (let i = 0;i < operations.length; i++) {
+    const op = operations[i];
+    if (!op)
+      continue;
+    for (const field of tokenStringFields(op)) {
+      if (field && hasAnyTokens(field)) {
+        errors.push({
+          code: "COMMIT_TOKEN_SYNTAX_REMOVED",
+          operationIndex: i,
+          message: COMMIT_TOKEN_SYNTAX_REMOVED_MESSAGE
+        });
         break;
-      if (last === m.start()) {
-        if (limit === 0) {
-          emptiesSkipped += 1;
-          last = m.end();
-          continue;
-        }
-      } else
-        while (emptiesSkipped > 0) {
-          result.push("");
-          emptiesSkipped -= 1;
-        }
-      result.push(m.substring(last, m.start()));
-      last = m.end();
-    }
-    if (limit === 0 && last !== m.inputLength()) {
-      while (emptiesSkipped > 0) {
-        result.push("");
-        emptiesSkipped -= 1;
       }
-      result.push(m.substring(last, m.inputLength()));
     }
-    if (limit !== 0 || result.length === 0)
-      result.push(m.substring(last, m.inputLength()));
-    return result;
   }
-  *matchAll(input) {
-    const m = this.matcher(input);
-    while (m.find()) {
-      const result = [m.group(0)];
-      for (let i = 1;i <= m.groupCount(); i++) {
-        const groupVal = m.group(i);
-        result.push(groupVal === null ? undefined : groupVal);
+}
+function illegalOpSequences(operations, errors, checkAddAdd) {
+  const opHistory = new Map;
+  for (let i = 0;i < operations.length; i++) {
+    const op = operations[i];
+    if (!op)
+      continue;
+    const name = getOpName(op);
+    if (!name)
+      continue;
+    if (hasAnyTokens(name))
+      continue;
+    const kind = inferOperationKind({ ...op, name });
+    const qualName = kind === "shape" ? `shape:${name}` : `thing:${name}`;
+    const history = opHistory.get(qualName) ?? [];
+    history.push({ operation: op.operation, index: i });
+    opHistory.set(qualName, history);
+  }
+  for (const [qualName, history] of opHistory) {
+    if (history.length < 2)
+      continue;
+    for (let i = 1;i < history.length; i++) {
+      const prev = history[i - 1];
+      const curr = history[i];
+      if (!prev || !curr)
+        continue;
+      const pair = `${prev.operation}+${curr.operation}`;
+      if (checkAddAdd && pair === "add+add") {
+        errors.push({
+          code: "ILLEGAL_OP_SEQUENCE",
+          operationIndex: curr.index,
+          message: `Cannot add "${qualName}" twice in the same commit`
+        });
+      }
+      if (pair === "revise+add") {
+        errors.push({
+          code: "ILLEGAL_OP_SEQUENCE",
+          operationIndex: curr.index,
+          message: `Cannot revise then add "${qualName}" in the same commit`
+        });
       }
-      result.index = m.start(0);
-      result.input = input;
-      const namedGroups = this.namedGroups();
-      if (Object.keys(namedGroups).length > 0) {
-        const parsedGroups = m.getNamedGroups();
-        for (const key in parsedGroups)
-          if (parsedGroups[key] === null)
-            parsedGroups[key] = undefined;
-        result.groups = parsedGroups;
-      } else
-        result.groups = undefined;
-      yield result;
     }
   }
-  toString() {
-    return this.patternInput;
+}
+
+// ../../packages/rules/src/preflight-operation.ts
+var collectionTypes = ["arc", "bond", "set", "list", "pair"];
+var canonicalCollectionTypes = ["arc", "bond", "set", "list"];
+var collectionOps = ["add", "revise"];
+var COLLECTION_CREATE_REQUIRES_NAME_MESSAGE = "Collection create requires a name. Collections are ordinary named things (ADR 0004).";
+var COLLECTION_ABOUT_REMOVED_MESSAGE = 'about accepts a wref. Create the collection as its own named operation, then point the assertion at it. Prefer deterministic relationship names, for example: [{"operation":"add","kind":"collection","type":"arc","name":"a-to-b","members":["A","B"]},{"operation":"add","kind":"assertion","about":"Arc/a-to-b","name":"Assertion/example","data":{}}]. For CLI usage, use wh commit submit --file with the two operations.';
+function preflightOpDiagnostics(op, operationIndex) {
+  const errors = [];
+  errors.push(...builtinShapeGuard(op, operationIndex));
+  errors.push(...contentNameGuard(op, operationIndex));
+  errors.push(...plusSignGuard(op, operationIndex));
+  errors.push(...validateCollectionAbouts(op, operationIndex));
+  errors.push(...validateCollectionOps(op, operationIndex));
+  return errors;
+}
+function builtinShapeGuard(op, operationIndex) {
+  const errors = [];
+  const name = op.name;
+  const isShapeRename = op.operation === "rename" && (op.kind === "shape" || op.name !== undefined && !splitLocalPath(op.name));
+  const reservedSourcePassThrough = isShapeRename && name !== undefined && isRenameableSquattedShape(name) && op.newName !== undefined && !isReservedCollectionShape(op.newName) && !isBuiltinShape(op.newName);
+  if (name && isRetiredCollectionShape(name) && !reservedSourcePassThrough) {
+    errors.push({
+      code: "RESERVED_NAME",
+      operationIndex,
+      message: `Shape "${name}" is a retired collection shape and cannot be written manually`
+    });
   }
-  programSize() {
-    return this.re2Input.numberOfInstructions();
+  if (op.operation === "rename" && (op.kind === "shape" || op.name !== undefined && !splitLocalPath(op.name)) && op.newName && isRetiredCollectionShape(op.newName)) {
+    errors.push({
+      code: "RESERVED_NAME",
+      operationIndex,
+      message: `Shape "${op.newName}" is a retired collection shape and cannot be written manually`
+    });
+  } else {
+    const builtinShapeName = name && isBuiltinShape(name) && !reservedSourcePassThrough ? name : isShapeRename && op.newName && isBuiltinShape(op.newName) ? op.newName : undefined;
+    if (builtinShapeName && (isShapeRename || op.operation !== "retract" && op.kind === "shape")) {
+      const action = op.operation === "add" ? "created" : op.operation === "rename" ? "renamed" : "revised";
+      errors.push({
+        code: "RESERVED_NAME",
+        operationIndex,
+        message: `Shape "${builtinShapeName}" is a built-in shape and cannot be ${action} manually`
+      });
+    }
   }
-  groupCount() {
-    return this.re2Input.numberOfCapturingGroups();
+  if (name) {
+    const local = splitLocalPath(name);
+    if (local && isRetiredCollectionShape(local.shapePrefix)) {
+      errors.push({
+        code: "VALIDATION_ERROR",
+        operationIndex,
+        message: `Cannot ${op.operation} under retired collection shape "${local.shapePrefix}". Triple is read-only and retired for new collection writes.`
+      });
+    } else if (op.kind === "thing" && local && isBuiltinCollectionShape(local.shapePrefix)) {
+      const message = op.operation === "add" ? `Cannot add kind="thing" under built-in shape "${local.shapePrefix}". Use kind="collection" instead.` : `Cannot revise kind="thing" under built-in shape "${local.shapePrefix}". Use kind="collection" to revise a collection.`;
+      errors.push({
+        code: "VALIDATION_ERROR",
+        operationIndex,
+        message
+      });
+    }
   }
-  namedGroups() {
-    return this.re2Input.namedGroups;
+  return errors;
+}
+function contentNameGuard(op, operationIndex) {
+  if (op.kind !== "thing" || !op.name)
+    return [];
+  const local = splitLocalPath(op.name);
+  if (!local || !isContentShape(local.shapePrefix))
+    return [];
+  const bareName = local.bareName;
+  if (isSynthesizedContentName(bareName)) {
+    return [
+      {
+        code: "READ_ONLY_BUILTIN_CONTENT",
+        operationIndex,
+        message: `${local.shapePrefix}/${bareName} is synthesized; writes are not allowed`
+      }
+    ];
   }
-  equals(other) {
-    if (this === other)
-      return true;
-    if (other === null || this.constructor !== other.constructor)
-      return false;
-    return this.flagsInput === other.flagsInput && this.patternInput === other.patternInput;
+  if (!isStoredContentName(bareName)) {
+    return [
+      {
+        code: "UNKNOWN_CONTENT_NAME",
+        operationIndex,
+        message: `${local.shapePrefix}/${bareName} is not a recognized well-known content name`
+      }
+    ];
   }
-};
-
-// ../../packages/rules/src/shape-validation-types.ts
-var MAX_CONTENT_FIELD_BYTES = 64 * 1024;
-var MAX_INDEXABLE_SCALAR_FIELDS_PER_SHAPE = 256;
-var MAX_INDEXABLE_FIELD_PATH_BYTES = 256;
-var UNSUPPORTED_REGEX_SYNTAX_REASON = "uses unsupported regex syntax";
-var CONTENT_FIELD_LIMIT_ERROR = `WarmHub content fields are limited to ${MAX_CONTENT_FIELD_BYTES} bytes. ` + "WarmHub is not a document store; store large documents in S3, Box, Drive, or another document system and reference them from WarmHub instead.";
-var textEncoder = new TextEncoder;
-function utf8ByteLength(value) {
-  return textEncoder.encode(value).byteLength;
+  return [];
 }
-function contentFieldLimitError(path, value) {
-  if (value.length * 3 <= MAX_CONTENT_FIELD_BYTES)
-    return null;
-  const byteLength = utf8ByteLength(value);
-  if (byteLength <= MAX_CONTENT_FIELD_BYTES)
-    return null;
-  return `Field "${path}" is ${byteLength} bytes; ${CONTENT_FIELD_LIMIT_ERROR}`;
+function plusSignGuard(op, operationIndex) {
+  const errors = [];
+  const name = op.name;
+  if (op.newName?.includes("+")) {
+    errors.push({
+      code: "VALIDATION_ERROR",
+      operationIndex,
+      message: `Name "${op.newName}" contains reserved character "+". The "+" character is reserved for the historical collection auto-name namespace and is not allowed in user-supplied names.`
+    });
+    return errors;
+  }
+  if (name?.includes("+")) {
+    if (op.kind === "collection" && op.operation === "add") {
+      errors.push({
+        code: "VALIDATION_ERROR",
+        operationIndex,
+        message: `Name "${name}" contains reserved character "+". The "+" character is reserved for the historical collection auto-name namespace and is not allowed in user-supplied names.`
+      });
+      return errors;
+    }
+    if (op.kind === "collection")
+      return errors;
+    const local = splitLocalPath(name);
+    if (local && isReservedCollectionShape(local.shapePrefix))
+      return errors;
+    errors.push({
+      code: "VALIDATION_ERROR",
+      operationIndex,
+      message: `Name "${name}" contains reserved character "+". The "+" character is reserved for the historical collection auto-name namespace and is not allowed in user-supplied names.`
+    });
+  }
+  return errors;
 }
-function assertContentFieldWithinLimit(path, value, errors) {
-  const message = contentFieldLimitError(path, value);
-  if (message)
-    errors.push(message);
+function validateCollectionAbouts(op, operationIndex) {
+  const errors = [];
+  if (!op.about || typeof op.about === "string")
+    return errors;
+  errors.push({
+    code: "VALIDATION_ERROR",
+    operationIndex,
+    message: COLLECTION_ABOUT_REMOVED_MESSAGE
+  });
+  return errors;
 }
-function nativeRegexSyntaxError(pattern) {
-  try {
-    new RegExp(pattern);
-    return false;
-  } catch {
-    return true;
+function validateCollectionOps(op, operationIndex) {
+  const errors = [];
+  if (op.kind !== "collection")
+    return errors;
+  if (!collectionOps.includes(op.operation)) {
+    return errors;
   }
-}
-function normalizePatternForPortableEngine(pattern) {
-  let normalized = "";
-  let inCharacterClass = false;
-  for (let i = 0;i < pattern.length; i++) {
-    const char = pattern[i];
-    if (char === "\\") {
-      const next = pattern[i + 1];
-      if (inCharacterClass && next === "b") {
-        normalized += "\\x08";
-        i++;
-        continue;
-      }
-      normalized += char;
-      if (next !== undefined) {
-        normalized += next;
-        i++;
+  if (op.operation === "add" && !op.name) {
+    errors.push({
+      code: "VALIDATION_ERROR",
+      operationIndex,
+      message: COLLECTION_CREATE_REQUIRES_NAME_MESSAGE
+    });
+  }
+  if (!op.type || !collectionTypes.includes(op.type)) {
+    errors.push({
+      code: "VALIDATION_ERROR",
+      operationIndex,
+      message: `Collection "type" is invalid. Use one of: ${canonicalCollectionTypes.join(", ")}. Got: "${op.type ?? ""}"`
+    });
+  }
+  if (!op.members || !Array.isArray(op.members)) {
+    errors.push({
+      code: "VALIDATION_ERROR",
+      operationIndex,
+      message: 'Collection requires a "members" array'
+    });
+  } else {
+    for (let i = 0;i < op.members.length; i++) {
+      if (typeof op.members[i] !== "string") {
+        errors.push({
+          code: "VALIDATION_ERROR",
+          operationIndex,
+          message: `Collection member at index ${i} must be a string`
+        });
       }
-      continue;
     }
-    if (char === "[") {
-      inCharacterClass = true;
-    } else if (char === "]") {
-      inCharacterClass = false;
+  }
+  if (op.type && op.members) {
+    const arityError = collectionArityError(op.type, op.members);
+    if (arityError) {
+      errors.push({
+        code: "VALIDATION_ERROR",
+        operationIndex,
+        message: arityError
+      });
     }
-    normalized += char;
   }
-  return normalized;
+  return errors;
 }
-function compilePortablePattern(pattern) {
-  try {
-    return RE2JS.compile(normalizePatternForPortableEngine(pattern));
-  } catch {
-    return;
+function collectionArityError(tag, members) {
+  switch (tag) {
+    case "arc":
+      return members.length !== 2 ? `Arc requires exactly 2 members, got ${members.length}` : null;
+    case "bond":
+      return members.length !== 2 ? `Bond requires exactly 2 members, got ${members.length}` : null;
+    case "pair":
+      return members.length !== 2 ? `Pair requires exactly 2 members, got ${members.length}` : null;
+    case "set":
+    case "list":
+      return members.length < 1 ? `${tag === "set" ? "Set" : "List"} requires at least 1 member, got 0` : null;
   }
 }
-function unsupportedPortablePatternReason(pattern) {
-  return compilePortablePattern(pattern) ? undefined : UNSUPPORTED_REGEX_SYNTAX_REASON;
+// ../../packages/rules/src/preflight.ts
+function preflightOpDiagnostics2(op, operationIndex) {
+  return preflightOpDiagnostics(op, operationIndex);
 }
-function normalizeOptionalTypeSpec(spec) {
-  if (typeof spec === "string" && spec.endsWith("?")) {
-    return { spec: spec.slice(0, -1), optionalByType: true };
-  }
-  if (isTypeSpecObject(spec) && typeof spec.type === "string" && spec.type.endsWith("?")) {
-    return {
-      spec: { ...spec, type: spec.type.slice(0, -1) },
-      optionalByType: true
-    };
-  }
-  return { spec, optionalByType: false };
+function preflightCommitDiagnostics2(operations, options) {
+  return preflightCommitDiagnostics(operations, options);
+}
+// ../../packages/rules/src/read-limits.ts
+var MAX_GET_MANY_WREFS = 500;
+// ../../packages/rules/src/reserved-orgs.ts
+var RESERVED_RAW_CONTENT_TOP_LEVEL_NAMES = [
+  "_app",
+  "_static",
+  "api",
+  "health",
+  "healthz",
+  "mcp",
+  "readyz",
+  "robots.txt",
+  "sse",
+  "trpc",
+  "version"
+];
+var RESERVED_ORG_NAMES = [
+  ...RESERVED_RAW_CONTENT_TOP_LEVEL_NAMES,
+  "admin",
+  "billing",
+  "blog",
+  "docs",
+  "help",
+  "login",
+  "public",
+  "settings",
+  "signup",
+  "status",
+  "support",
+  "system",
+  "warmhub",
+  "www"
+];
+var RESERVED_ORG_NAME_SET = new Set(RESERVED_ORG_NAMES);
+// ../../packages/rules/src/shape-field-key.ts
+function foldFieldName(name) {
+  const stripped = name.endsWith("?") ? name.slice(0, -1) : name;
+  return stripped.toLowerCase();
+}
+function foldFieldPath(path) {
+  return path.split(".").map((segment) => foldFieldName(segment)).join(".");
 }
-
 // ../../packages/rules/src/shape-validation-runtime.ts
 function validatePersistedStringFieldLimits(value, typeDef, errors, path) {
   const normalized = normalizeOptionalTypeSpec(typeDef).spec;
@@ -27379,8 +27475,9 @@ function validatePersistedStringFieldLimits(value, typeDef, errors, path) {
   }
   if (Array.isArray(value)) {
     const elementType = arrayElementType(normalized);
-    if (elementType === undefined && !isDeclaredArrayType(normalized))
+    if (normalized !== undefined && elementType === undefined && !isDeclaredArrayType(normalized)) {
       return;
+    }
     for (let i = 0;i < value.length; i++) {
       validatePersistedStringFieldLimits(value[i], elementType, errors, `${path ?? "<value>"}[${i}]`);
     }
@@ -27392,7 +27489,9 @@ function validatePersistedStringFieldLimits(value, typeDef, errors, path) {
   if (normalized !== undefined && fields === undefined)
     return;
   for (const [key, nestedValue] of Object.entries(value)) {
-    validatePersistedStringFieldLimits(nestedValue, fields?.get(key), errors, path ? joinFieldPath(path, key) : escapeFieldNameForDisplay(key));
+    const keyPath = path ? joinFieldPath(path, key) : escapeFieldNameForDisplay(key);
+    assertContentFieldWithinLimit(keyPath, key, errors);
+    validatePersistedStringFieldLimits(nestedValue, fields?.get(key), errors, keyPath);
   }
 }
 function isDeclaredStringType(typeDef) {
@@ -28436,7 +28535,7 @@ function dedupeDeprecationsByShape(results) {
 // ../../packages/sdk-ts/package.json
 var package_default = {
   name: "@warmhub/sdk-ts",
-  version: "0.77.1",
+  version: "0.79.0",
   private: false,
   type: "module",
   description: "The TypeScript SDK for WarmHub — create repos, commit and query data, and compound knowledge with your AI agents.",
@@ -29582,6 +29681,26 @@ class WarmHubClient {
         throw toWarmHubError(error);
       }
     },
+    getLicense: async (orgName, repoName) => {
+      try {
+        return await this.trpc.repo.getLicense.query({
+          orgName,
+          repoName
+        });
+      } catch (error) {
+        throw toWarmHubError(error);
+      }
+    },
+    describe: async (orgName, repoName) => {
+      try {
+        return await this.trpc.repo.describe.query({
+          orgName,
+          repoName
+        });
+      } catch (error) {
+        throw toWarmHubError(error);
+      }
+    },
     setReadme: async (orgName, repoName, content) => {
       try {
         assertContentWithinLimit("Content/Readme.content", content);
@@ -29904,6 +30023,13 @@ class WarmHubClient {
         throw toWarmHubError(error);
       }
     },
+    latestRuns: async (orgName, repoName) => {
+      try {
+        return await this.trpc.action.latestRuns.query({ orgName, repoName });
+      } catch (error) {
+        throw toWarmHubError(error);
+      }
+    },
     runStats: async (orgName, repoName, opts) => {
       try {
         return await this.trpc.action.runStats.query({
@@ -42827,6 +42953,42 @@ function getHttpTimeoutSnapshot() {
   return snapshot;
 }
 
+// ../../packages/warmhub-cli/src/domains/doctor-repo-license.ts
+var LICENSE_SUBSTRATE = "warmhub-data/global.reference.licenses";
+async function checkRepoLicenseDeclaration(ctx, repo, repoInfo) {
+  if (repoInfo.visibility !== "public")
+    return null;
+  const safeRepoRef = escapeTerminalTextForDisplay(repo.ref);
+  try {
+    const license = await ctx.client.repo.getLicense(repo.orgName, repo.repoName);
+    if (license) {
+      const safeSpdxId = escapeTerminalTextForDisplay(license.spdxId);
+      return {
+        key: "repo-license",
+        name: "repo-license",
+        status: "ok",
+        message: `Public repo ${safeRepoRef} declares ${safeSpdxId}`
+      };
+    }
+    return {
+      key: "repo-license",
+      name: "repo-license",
+      status: "warn",
+      message: `Public repo ${safeRepoRef} has no repository license declaration.`,
+      detail: `Choose the correct license, then create the native LicenseSubject/repo thing and LicenseDeclaration/repo assertion. Set spdxIdRaw and, when applicable, licenseWref to a canonical License in ${LICENSE_SUBSTRATE}. No component installation is required.`
+    };
+  } catch (error) {
+    const failure = classifyDoctorLookupError(error);
+    const safeDescription = escapeTerminalTextForDisplay(failure.description);
+    return {
+      key: "repo-license",
+      name: "repo-license",
+      status: "warn",
+      message: `Could not verify repository license declaration for public repo ${safeRepoRef}: ${safeDescription}`
+    };
+  }
+}
+
 // ../../packages/warmhub-cli/src/domains/doctor-checks.ts
 async function collectChecks(ctx) {
   const harnessPaths = getHarnessPaths();
@@ -42872,14 +43034,18 @@ async function collectChecks(ctx) {
     status: apiUrl ? "ok" : "fail",
     message: apiUrl ? `API URL: ${apiUrl}` : "WARMHUB_API_URL not set and no default available"
   });
-  const repo = ctx.config.defaultRepo;
-  const repoSource = ctx.config.configSource?.repo;
+  const repoFlag = getRepoRef(ctx);
+  const hasRepoFlag = repoFlag !== undefined;
+  const repo = repoFlag ?? ctx.config.defaultRepo;
+  const repoParts = repo !== undefined ? splitRepoSlug(repo) : null;
+  const repoForDisplay = repo !== undefined ? escapeTerminalTextForDisplay(repo) : undefined;
+  const repoSource = hasRepoFlag ? "flag" : ctx.config.configSource?.repo;
   const repoProvenance = repoSource === "env" ? " (from WARMHUB_REPO)" : repoSource === "wh-file" ? " (from .wh file)" : repoSource === "flag" ? " (from --repo flag)" : "";
   checks.push({
     key: "default-repo",
     name: "default-repo",
-    status: repo ? "ok" : "warn",
-    message: repo ? `Default repo: ${repo}${repoProvenance}` : "No default repo set (use --repo flag, WARMHUB_REPO, or wh use org/repo)"
+    status: repo !== undefined ? repoParts ? "ok" : "fail" : "warn",
+    message: repo !== undefined ? repoParts ? `${hasRepoFlag ? "Target" : "Default"} repo: ${repoForDisplay}${repoProvenance}` : `Invalid repo format "${repoForDisplay}". Expected "org/repo".` : "No default repo set (use --repo flag, WARMHUB_REPO, or wh use org/repo)"
   });
   const profileFlag = ctx.invocation.flags.profile;
   const profile = (typeof profileFlag === "string" ? profileFlag : undefined) ?? ctx.config.profile ?? ctx.profile ?? "default";
@@ -42987,7 +43153,8 @@ async function collectChecks(ctx) {
       });
     }
   }
-  if (repo?.includes("/")) {
+  if (repo !== undefined && repoParts) {
+    const safeRepoRef = escapeTerminalTextForDisplay(repo);
     if (!backendOk) {
       checks.push({
         key: "repo",
@@ -42996,22 +43163,25 @@ async function collectChecks(ctx) {
         message: "Skipped (backend unreachable)"
       });
     } else {
-      const [orgName, repoName] = repo.split("/", 2);
+      const { org: orgName, repo: repoName } = repoParts;
       try {
-        await ctx.client.repo.get(orgName, repoName);
+        const repoInfo = await ctx.client.repo.get(orgName, repoName);
         checks.push({
           key: "repo",
           name: "repo",
           status: "ok",
-          message: `Repo ${repo} exists`
+          message: `Repo ${safeRepoRef} exists`
         });
+        const licenseCheck = await checkRepoLicenseDeclaration(ctx, { ref: repo, orgName, repoName }, repoInfo);
+        if (licenseCheck)
+          checks.push(licenseCheck);
       } catch (e) {
         const failure = classifyDoctorLookupError(e);
         checks.push({
           key: "repo",
           name: "repo",
           status: "fail",
-          message: failure.classification === "not-found" ? `Repo ${repo} not found: ${failure.description}` : `Repo ${repo} lookup failed: ${failure.description}`
+          message: failure.classification === "not-found" ? `Repo ${safeRepoRef} not found: ${failure.description}` : `Repo ${safeRepoRef} lookup failed: ${failure.description}`
         });
       }
     }
@@ -44720,8 +44890,9 @@ var handleDescribe = async (ctx, { args, flags }) => {
   const { org, repo } = parseOrgRepo(repoRef, ctx.config);
   const c = ctx.colors;
   const showIndexedFields = flags["indexed-fields"] === true;
-  const [repoInfo, shapesPage, stats, indexedFields] = await Promise.all([
+  const [repoInfo, license, shapesPage, stats, indexedFields] = await Promise.all([
     ctx.client.repo.get(org, repo),
+    ctx.client.repo.getLicense(org, repo),
     ctx.client.shape.list(org, repo),
     ctx.client.repo.getStats(org, repo),
     showIndexedFields ? ctx.client.repo.index.describe(org, repo) : null
@@ -44744,6 +44915,7 @@ var handleDescribe = async (ctx, { args, flags }) => {
     org,
     repo,
     description: repoInfo.description ?? null,
+    license,
     counts: {
       byKind: stats.byKind,
       byShape
@@ -44767,6 +44939,7 @@ var handleDescribe = async (ctx, { args, flags }) => {
     if (repoInfo.description) {
       ctx.out(`  ${escapeTerminalTextForDisplay(repoInfo.description)}`);
     }
+    ctx.out(`  License: ${license ? escapeTerminalTextForDisplay(license.spdxExpression ?? license.spdxId) : "not declared"}`);
     ctx.out("");
     ctx.out(`${c.bold}Counts${c.reset}  ${stats.byKind.shape} shapes, ${stats.byKind.thing} things, ${stats.byKind.assertion} assertions (${stats.total} total)`);
     const shapeCountEntries = Object.entries(byShape);
@@ -48924,7 +49097,7 @@ function resolveLogLevel(flagLevel, env) {
 // package.json
 var package_default3 = {
   name: "@warmhub/cli",
-  version: "0.79.1",
+  version: "0.81.0",
   private: false,
   type: "module",
   description: "The wh CLI for WarmHub — create repos, commit and query data, and compound knowledge with your AI agents.",
@@ -49541,5 +49714,5 @@ process.exitCode = interceptedExitCode === undefined ? await runPreparedCli(laun
   version: package_default3.version
 }) : interceptedExitCode;
 
-//# debugId=4AEF348829257D9564756E2164756E21
-//# warmhub-cli-build-info {"cliVersion":"0.79.1","sdkVersion":"0.77.1"}
+//# debugId=2DA8F489DEFC62BA64756E2164756E21
+//# warmhub-cli-build-info {"cliVersion":"0.81.0","sdkVersion":"0.79.0"}